ClawHub
Back to skill

Security audit

小红书视频深度总结(本地)

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended to summarize Xiaohongshu videos locally, but users should review its handling of tokenized links, local credentials, and archival to Obsidian/IMA before installing.

Install only if you are comfortable with an agent downloading Xiaohongshu videos, storing transcripts locally, and potentially archiving them to Obsidian/IMA. Treat xsec_token links and any browser cookies as sensitive, and ask the agent to run in local-only mode unless you explicitly want archival.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def download_video(video_url):
    log("2/4 下载视频 (curl) ...")
    r = subprocess.run(["curl", "-s", "-L", video_url, "-o", "xhs_temp.mp4"], check=True)
    if not os.path.exists("xhs_temp.mp4") or os.path.getsize("xhs_temp.mp4") < 1024:
        raise RuntimeError("视频下载失败或文件过小")
Confidence
88% confidence
Finding
The script downloads a URL derived from remote metadata using curl without validating the scheme, host, or destination. If yt-dlp or the upstream page yields a crafted stream URL, this can trigger server-side request forgery behavior or unexpected local/protocol access from the machine running the skill.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documents shell execution, environment-variable use, and file writes, but does not declare corresponding permissions or capabilities. This creates a transparency and policy-enforcement gap: an agent or user may invoke a skill that can write files and run local commands without explicit approval boundaries, increasing the risk of unintended local side effects.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The skill claims processing is fully local and free, but later includes archival into external knowledge bases requiring credentials. This is a trust and disclosure issue: users may reasonably assume no data leaves the local workflow, while the documented process can copy transcripts and metadata into other systems.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README instructs users to paste Xiaohongshu share links containing `xsec_token` and describes downloading and transcribing third-party video content, but it does not explicitly warn that such links may carry session-linked or access-granting data. In an agent/LLM workflow, encouraging users to paste these links without a sensitivity warning increases the risk of unintended disclosure, retention, or reuse of token-bearing URLs and unauthorized processing of third-party content.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs writing collected content into external knowledge bases and references use of IMA credentials, but does not provide a prominent warning or consent step around exporting potentially sensitive transcript data. If used on private or sensitive content, this could lead to unintended persistence in third-party or synced storage beyond the user's immediate local workspace.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.